Cpe:2.3:a:password_protect_wordpress:password_protect_pages:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apassword_protect_wordpresspassword_protect_pageswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPassword Protect WordPress: Stored Cross-Site Scripting (CVE-2026-116520)https://feed.craftedsignal.io/briefs/2026-10-ppwp-xss/Sat, 31 Oct 2026 07:51:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ppwp-xss/The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.The PPWP - Password Protect Pages plugin for WordPress (versions up to and including 1.9.26) contains a Stored Cross-Site Scripting vulnerability. Insufficient input sanitization and output escaping of the 'desc_below_form' and 'placeholder' attributes allow unauthenticated attackers to inject arbitrary web scripts into WordPress pages. The vulnerability is further enabled by the plugin's comment filtering logic, which ignores bare shortcode text, and the 'comment_whitelist' setting, which can auto-approve comments from previously approved authors.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress site when a victim views an injected page. This may lead to session hijacking, unauthorized actions performed on behalf of administrators, or further redirection of users to malicious sites.

Recommendation

  • Update the PPWP - Password Protect Pages plugin to the version following 1.9.26 (or the latest available patch) as soon as it becomes available.
  • Review the 'comment_whitelist' configuration in the WordPress administrative panel and disable it if not strictly required to mitigate the persistence of unauthenticated malicious comments.
  • Implement a Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts on the WordPress installation.
  • Hunt for web requests containing malicious script tags or JavaScript event handlers (e.g., onerror, onload, onclick) directed at pages utilizing the vulnerable shortcodes.
]]>highadvisoryxssweb-vulnerabilitywordpresscve-2026-116520